From b4678e54379f5482ffa0e2fe3d23433ca15a7580 Mon Sep 17 00:00:00 2001 From: mr-forust Date: Mon, 14 Sep 2026 11:54:28 +0200 Subject: [PATCH] feat(postgres): upgrade shared database to PostgreSQL 17 Move the shared postgres service from 15.19 to 17.6 as the postgres17 StatefulSet with its own PVC, extend the initdb and ingress policy with the statuspage database, and drop the now-unused per-app postgres manifests for authentik, gitea and netronome. --- authentik/k8s/postgresql.yaml | 66 ---------------------------- gitea/k8s/postgres.yaml | 62 --------------------------- netronome/k8s/postgres.yaml | 71 ------------------------------- postgres/k8s/network-policy.yaml | 5 ++- postgres/k8s/postgres.yaml | 43 ++++++++++++------- postgres/k8s/secrets.yaml.example | 1 + 6 files changed, 32 insertions(+), 216 deletions(-) delete mode 100644 authentik/k8s/postgresql.yaml delete mode 100644 gitea/k8s/postgres.yaml delete mode 100644 netronome/k8s/postgres.yaml diff --git a/authentik/k8s/postgresql.yaml b/authentik/k8s/postgresql.yaml deleted file mode 100644 index 9199cb3..0000000 --- a/authentik/k8s/postgresql.yaml +++ /dev/null @@ -1,66 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: authentik-postgres-service - namespace: authentik -spec: - clusterIP: None - selector: - app: authentik-postgres - ports: - - port: 5432 - targetPort: 5432 ---- -apiVersion: apps/v1 -kind: StatefulSet -metadata: - name: authentik-postgres-statefulset - namespace: authentik -spec: - selector: - matchLabels: - app: authentik-postgres - serviceName: authentik-postgres-service - replicas: 1 - template: - metadata: - labels: - app: authentik-postgres - spec: - containers: - - name: postgres - image: docker.io/library/postgres:15.19-alpine - env: - - name: POSTGRES_DB - value: authentik - - name: POSTGRES_USER - valueFrom: - secretKeyRef: - name: authentik-secrets - key: AUTHENTIK_POSTGRESQL__USER - - name: POSTGRES_PASSWORD - valueFrom: - secretKeyRef: - name: authentik-secrets - key: AUTHENTIK_POSTGRESQL__PASSWORD - ports: - - containerPort: 5432 - name: postgres - volumeMounts: - - name: postgres-data - mountPath: /var/lib/postgresql/data - resources: - requests: - memory: "256Mi" - cpu: "200m" - limits: - memory: "1Gi" - cpu: "500m" - volumeClaimTemplates: - - metadata: - name: postgres-data - spec: - accessModes: ["ReadWriteOnce"] - resources: - requests: - storage: 5Gi diff --git a/gitea/k8s/postgres.yaml b/gitea/k8s/postgres.yaml deleted file mode 100644 index 90a1cc6..0000000 --- a/gitea/k8s/postgres.yaml +++ /dev/null @@ -1,62 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: gitea-postgres-service - namespace: gitea -spec: - clusterIP: None - selector: - app: gitea-postgres - ports: - - port: 5432 - targetPort: 5432 ---- -apiVersion: apps/v1 -kind: StatefulSet -metadata: - name: gitea-postgres-statefulset - namespace: gitea -spec: - selector: - matchLabels: - app: gitea-postgres - serviceName: gitea-postgres-service - replicas: 1 - template: - metadata: - labels: - app: gitea-postgres - spec: - containers: - - name: gitea-postgres - image: postgres:14.24-alpine - env: - - name: POSTGRES_USER - valueFrom: - secretKeyRef: - name: gitea-secrets - key: GITEA__database__USER - - name: POSTGRES_PASSWORD - valueFrom: - secretKeyRef: - name: gitea-secrets - key: GITEA__database__PASSWD - - name: POSTGRES_DB - valueFrom: - secretKeyRef: - name: gitea-secrets - key: GITEA__database__NAME - ports: - - containerPort: 5432 - name: postgres - volumeMounts: - - name: postgres-data - mountPath: /var/lib/postgresql/data - volumeClaimTemplates: - - metadata: - name: postgres-data - spec: - accessModes: ["ReadWriteOnce"] - resources: - requests: - storage: 1Gi diff --git a/netronome/k8s/postgres.yaml b/netronome/k8s/postgres.yaml deleted file mode 100644 index 1c3a2e8..0000000 --- a/netronome/k8s/postgres.yaml +++ /dev/null @@ -1,71 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: netronome-postgres-service - namespace: netronome -spec: - selector: - app: netronome-postgres - ports: - - protocol: TCP - port: 5432 - targetPort: 5432 ---- -apiVersion: apps/v1 -kind: StatefulSet -metadata: - name: netronome-postgres - namespace: netronome -spec: - serviceName: "netronome-postgres-service" - replicas: 1 - selector: - matchLabels: - app: netronome-postgres - template: - metadata: - labels: - app: netronome-postgres - spec: - containers: - - name: netronome-postgres - image: postgres:17.11-alpine - ports: - - name: postgres-port - protocol: TCP - containerPort: 5432 - env: - - name: POSTGRES_USER - valueFrom: - secretKeyRef: - name: netronome-secrets - key: NETRONOME__DB_USER - - name: POSTGRES_PASSWORD - valueFrom: - secretKeyRef: - name: netronome-secrets - key: NETRONOME__DB_PASSWORD - - name: POSTGRES_DB - valueFrom: - configMapKeyRef: - name: netronome-config - key: NETRONOME__DB_NAME - resources: - requests: - memory: "512Mi" - cpu: "500m" - limits: - memory: "1Gi" - cpu: "1000m" - volumeMounts: - - name: netronome-pg-data - mountPath: /var/lib/postgresql/data - volumeClaimTemplates: - - metadata: - name: netronome-pg-data - spec: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 1Gi diff --git a/postgres/k8s/network-policy.yaml b/postgres/k8s/network-policy.yaml index 3877836..b4ec4dd 100644 --- a/postgres/k8s/network-policy.yaml +++ b/postgres/k8s/network-policy.yaml @@ -6,7 +6,7 @@ metadata: spec: podSelector: matchLabels: - app.kubernetes.io/name: postgres + app.kubernetes.io/name: postgres17 policyTypes: - Ingress ingress: @@ -23,6 +23,9 @@ spec: - namespaceSelector: matchLabels: kubernetes.io/metadata.name: penpot + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: statuspage ports: - protocol: TCP port: 5432 diff --git a/postgres/k8s/postgres.yaml b/postgres/k8s/postgres.yaml index 531ff3b..e4707f5 100644 --- a/postgres/k8s/postgres.yaml +++ b/postgres/k8s/postgres.yaml @@ -4,11 +4,11 @@ metadata: name: postgres namespace: database labels: - app.kubernetes.io/name: postgres + app.kubernetes.io/name: postgres17 app.kubernetes.io/part-of: homelab-database spec: selector: - app.kubernetes.io/name: postgres + app.kubernetes.io/name: postgres17 ports: - name: postgres port: 5432 @@ -17,22 +17,22 @@ spec: apiVersion: apps/v1 kind: StatefulSet metadata: - name: postgres + name: postgres17 namespace: database spec: - serviceName: postgres + serviceName: postgres17 replicas: 1 selector: matchLabels: - app.kubernetes.io/name: postgres + app.kubernetes.io/name: postgres17 template: metadata: labels: - app.kubernetes.io/name: postgres + app.kubernetes.io/name: postgres17 spec: containers: - name: postgres - image: postgres:15.19-alpine + image: postgres:17.6-alpine ports: - name: postgres containerPort: 5432 @@ -66,19 +66,28 @@ spec: initialDelaySeconds: 30 periodSeconds: 20 volumes: + - name: postgres-data + persistentVolumeClaim: + claimName: postgres17-data - name: initdb configMap: name: postgres-initdb defaultMode: 0755 - volumeClaimTemplates: - - metadata: - name: postgres-data - spec: - accessModes: ["ReadWriteOnce"] - storageClassName: local-path-retain - resources: - requests: - storage: 20Gi +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: postgres17-data + namespace: database + labels: + app.kubernetes.io/name: postgres17 + app.kubernetes.io/part-of: homelab-database +spec: + accessModes: ["ReadWriteOnce"] + storageClassName: local-path-retain + resources: + requests: + storage: 20Gi --- apiVersion: v1 kind: ConfigMap @@ -94,6 +103,7 @@ data: : "${GITEA_DB_PASSWORD:?GITEA_DB_PASSWORD is required}" : "${NETRONOME_DB_PASSWORD:?NETRONOME_DB_PASSWORD is required}" : "${PENPOT_DB_PASSWORD:?PENPOT_DB_PASSWORD is required}" + : "${STATUSPAGE_DB_PASSWORD:?STATUSPAGE_DB_PASSWORD is required}" create_role_and_database() { local role="$1" @@ -113,3 +123,4 @@ data: create_role_and_database gitea gitea "$GITEA_DB_PASSWORD" create_role_and_database netronome netronome "$NETRONOME_DB_PASSWORD" create_role_and_database penpot penpot "$PENPOT_DB_PASSWORD" + create_role_and_database statuspage statuspage "$STATUSPAGE_DB_PASSWORD" \ No newline at end of file diff --git a/postgres/k8s/secrets.yaml.example b/postgres/k8s/secrets.yaml.example index d905da1..4768d78 100644 --- a/postgres/k8s/secrets.yaml.example +++ b/postgres/k8s/secrets.yaml.example @@ -10,3 +10,4 @@ stringData: GITEA_DB_PASSWORD: "" NETRONOME_DB_PASSWORD: "" PENPOT_DB_PASSWORD: "" + STATUSPAGE_DB_PASSWORD: ""